Slashdot Mirror

← Back to Stories (view on slashdot.org)

Understanding NFS

Posted by michael on from the things-man-was-not-meant-to-know dept.

LiquidPC writes: "ONLamp.com's Big Scary Daemons section has yet another great new BSD article, this one on Understanding NFS and using it in FreeBSD."

138 comments

  1. So who's NFS? by Anonymous Coward · · Score: 3, Funny

    RMS's sister?

  2. A printer and human friendly version by Shiny+Metal+S. · · Score: 3, Informative

    Here's a printer and human friendly version, for those of you, who don't like half-screen animated ads inside the text you try to read.

    --

    ~shiny
    WILL HACK FOR $$$

  3. What about security??? by Anonymous Coward · · Score: 4, Interesting

    I'm appalled that he considers IP address matching to be a way of preventing abuse. Sure, his cable modem is a separate interface so he can use a firewall to block it. But what if you're on a large untrusted LAN and you want to share files between two machines? I have exactly this problem (I have a laptop and a desktop at university) and I'm still looking for a simple yet secure way to share between them without allowing anyone to just spoof the IP address (and preferrably without transmitting my secret plans for world domination over the wire in the clear).

    1. Re:What about security??? by Anonymous Coward · · Score: 0

      It's called Coda. Set aside a week or two out of your terribly busy schedule and set it up - you'll be happy you did.

    2. Re:What about security??? by autechre · · Score: 5, Informative

      As someone else has already mentioned, you could use the Self-certifying File System .

      You could also establish an encrypted tunnel between the two machines using whatever implementation of IPSEC they have (Linux has FreeSWAN, OpenBSD has something built into the kernel, not sure about others). Then you could share stuff however you wanted.

      We're currently using NFS to share our MP3 collections on our private network (behind the firewall/gateway), and it's not a big problem there. But for any network I don't trust (and I'm not very trustworthy :), I'd stay away from it.

      --
      WMBC freeform/independent online radio.
    3. Re:What about security??? by The+Original+Bobski · · Score: 2

      You forgot to mention that is a SOLID week or three to set up Coda (give up your life in the mean time). Even when it works, it does so for only a minuscule subset of needs. The resources it consumes may not be worth it.

      While I admire the effort, Coda is far and away from addressing real world connectivity problems. rsync works just as well without the major headaches and overhead.

      --
      satire, n: 1) witty language used to convey insults or scorn; 2) a form of humor lost on most slashdot moderators.
    4. Re:What about security??? by Zarquon · · Score: 1

      I've found VTUN works pretty well, and runs on most anything pppd runs on.

      --
      "'Tis great confidence in a friend to tell him your faults, greater to tell him his." --Poor Richard's Almanac
    5. Re:What about security??? by AtomicBomb · · Score: 3, Informative

      I agree securing NFS is a hard problem in a hostile environment. Basically, NFS is wide open if you managed to root one machine. A group of my friends at university used to boot machines using linux bootdisk. Then, mimics other guys UID, IP etc to fool the NFS server. If you gain root after login, a clue-up sysadmin should be able to track you down... Boot floppy is the killer here. Well, you can say the computer guys should disable floppy booting option in BIOS. But, they cannot really do much as some student need to boot with floppy occasionally (we are in CSE).

      Simple tricks no longer works when we switched to something more secure, AFS , in our case.... It is way more advanced than NFS. For example, as a normal user, I can authorise only a few trusted person to have access to one of my designated subdir.

    6. Re:What about security??? by Anonymous Coward · · Score: 0

      So talking about security? Yes, up to version 3 you should not (read: cannot) spread NFS across administrative boundaries. But what am I reading here about alternatives? NFS over SHH? SFS? Eww.

      If you want NFS *and* security, simply use NFS version 4. NFSv4 has RPCSEC_GSS (strong crypto+auth) builtin and much better caching/locking/failure strategies than NFSv3.

      Up till now there are NFSv4 implementations for OpenBSD, Linux and Solaris, maybe more.

      PS: Oh yes, they also dumped mountd and nlm.

    7. Re:What about security??? by jayed_99 · · Score: 2

      Boot floppy is the killer here. Well, you can say the computer guys should disable floppy booting option in BIOS. But, they cannot really do much as some student need to boot with floppy occasionally (we are in CSE).

      You're lucky you're not on any network I've ever admin'd. In my mind, no end-user ever has a need to use a boot floppy. If they do, then that means the machine is broken and, ergo, they should come and find me.

      If they need to use a boot floppy -- perhaps to demonstrate some elegant 1.44MB proof of concept, then they can use a development machine on a development network. (Please read "development" as "I don't give a rat's ass; we blow them away every Friday anyway").

      In a production network, there is no reason that an end-user would ever need to use a boot floppy. Well, there is no legitimate reason that an end-user would need one. In fact, it's difficult to determine a legitimate reason that an end-user would need to use a boot floppy on a development network.

    8. Re:What about security??? by Ubi_NL · · Score: 2

      I always thought NFS meant "No File Security"

      --

      If an experiment works, something has gone wrong.
    9. Re:What about security??? by Graspee_Leemoor · · Score: 1

      IP address spoofing (in the classical sense of injecting fake information into the packets you send) is a way of STOPPING certain packets from reaching the intended destination rather than INTERCEPTING packets meant for some destination.

      However, if you mean another machine on the LAN having the IP address as you expect your other machine to have then ok, yes, and especially with DHCP in effect...

      But there is a simple solution: Have each machine only open one port to the outside world, use scp (secure copy) and even run it on a non-standard port and change the password every day if you feel like it.

      graspee

    10. Re:What about security??? by AtomicBomb · · Score: 1

      In fact, it's difficult to determine a legitimate reason that an end-user would need to use a boot floppy on a development network.
      It makes sense to separate the network into a production and development subsystems... I wish my system admin is as cool as you.

      However, I have some serious doubt whether we can eliminate the need of boot floppy in a development network altogether. Say, you are playing around with RTLinux or other kernel hacks for your project, you just leave with 2 options:
      1) using boot floppy (boot CD, zip etc)
      2) write that directly to harddrive

      Let's forget about bad intentions first. Option 2 needs more attention from sysadmin. (A careless student may overwrite the original linux kernel with his hack... you may need to wipe the the development machine clean before Friday....)

    11. Re:What about security??? by Oshu · · Score: 1

      Securing NFS is like securing anything else in a hostle enviornment: Do what you can to lock down the protocol. Then make sure you have a nice intrusion detection system (like snort) that can shutdown the services if any funny business is detected.

      Just my $0.02.

      --

      That damn time machine set me back 15 years!

    12. Re:What about security??? by Electrum · · Score: 2

      I always thought NFS meant "No File Security"

      DJB calls it Network Failure System.

  4. Kaos BSD has a better FS. by kiwipeso · · Score: 0

    Is it just me, or is NFS an acronym for No Fucking System?

    Seriously, I'm doing a journaled database file system that runs way better than some old dog FS which has had it's day.

    Any suggestions for Kauri would be good, it's a grid file system with CVS like features.

    All Your BSD Are Belong To Us!

    --
    - Kaos games and encryption systems developer
    1. Re:Kaos BSD has a better FS. by dmelomed · · Score: 1

      Network Failure System.

  5. Yay! A NFS which works! by Anonymous Coward · · Score: 0

    Amazing enough, BSD had working NFS, what, almost
    20 years ago? And now the true blue BSD unix
    you have come to know and love is freely available
    to run on your PC.

  6. Corrections, pointers, and cautions by angio · · Score: 5, Informative
    A few things in the article deserve to be clarified. First, Lucas states that "One thing to note is that NFS uses the same usernames on each side of the connection." This is not accurate - NFS uses the same UIDs on both sides of the connection. If you don't have a unified UID space between your machines, you'll have .. issues.

    Second, if you export NFS to the world, you're insane and deserve what you get. If you want remote filesystem access, use a secure protocol like the Self-Certifing Filesystem (SFS). SFS also avoids completely the problem of having a shared UID space.

    Finally, his advice to mount your filesystems intr is good. But insufficient - also mount them soft, so that filesystem calls will eventually timeout if the server goes poof.

    1. Re:Corrections, pointers, and cautions by Phexro · · Score: 2

      Quick pointers to NFS U/GID space solutions:

      * rpc.ugidd - easy, but insecure. can leak u/gid info to untrusted parties. only works with userspace nfs server in linux - don't know about other opsystems.
      * use the same u/gids on every server - almost certainly not an option.
      * use a shared PAM back-end, such as LDAP (what I use), MySQL, or PostgreSQL

    2. Re:Corrections, pointers, and cautions by Anonymous Coward · · Score: 0

      A small warning from the "Distribution" page of that SFS site; user emptor:

      "Several of the SFS authors use SFS for their home directories without any problems. SFS has been in use for several years and we have never lost a file. That said, SFS should still be considered pre-alpha. Though it has been stable on the platforms we've used, it could trigger bugs in your operating system and crash your machine, or even open up security holes. More importantly, the SFS protocols will likely change in incompatible ways in the future."

    3. Re:Corrections, pointers, and cautions by HalfFlat · · Score: 3, Informative

      The "soft" mount option used often to be called the "corrupt" option.

      The problem is that programs rarely check to see if a write() fails after a successful open(). When the file system moves around under them, they can fail to write important data in blissful ignorance. This can lead to files whose contents are essentially broken.

      The fault doesn't really lie with NFS, so much as with the lage body of code which assumes write() calls to a file are more reliable than NFS soft-mounted file systems allow.

      Generally speaking, using soft mount is asking for trouble.

    4. Re:Corrections, pointers, and cautions by norwoodites · · Score: 1

      The real old way was using YP(NIS).

      Yes this was should be avoided unless you are on a secured network and have you can block ips on udp/rpc.

    5. Re:Corrections, pointers, and cautions by norwoodites · · Score: 1

      If read the /. news around December 16, you would see this has been fixed and other nfs bugs(the rest were client side ones): http://slashdot.org/article.pl?sid=01/12/16/151250 &mode=nested&tid=128 .

  7. caveats by Alien54 · · Score: 2
    One thing to note is that NFS uses the same usernames on each side of the connection. My files are owned by mwlucas on the server, so they are owned by mwlucas on the client. This can be a problem on a large network where users have root on their own machines. To create a central repository of authorized users, consider Kerberos or NIS. On a small network, or on a network with limited administrators, this usually isn't a problem.

    Pre-planning is useful, as always

    --
    "It is a greater offense to steal men's labor, than their clothes"
    1. Re:caveats by Anonymous Coward · · Score: 0

      Yes but have you ever gotten kerberos to work with NFS under FreeBSD?

  8. Good starter article, maybe by spacey · · Score: 2, Informative

    I don't think this article qualifies as "understanding nfs". NFS is a hairy beast, and all this does is get you started from the userland point of view. What makes nfs so hairy is the numerous ways it can fail or at least not do what you expect.

    -Peter

    --
    == Just my opinion(s)
  9. Funny that. by Bluetick · · Score: 1

    I've been looking on Google for about ten minutes for information about NFS I could understand and, just sort of a broad overview of it. Always something germane and informative on Slashdot ;).

    1. Re:Funny that. by Anonymous Coward · · Score: 0

      you stupid asshole, you must not have been reading slashdot for long.

      and, read the man pages.

  10. NFS does have problems... by Anonymous Coward · · Score: 0, Redundant
    I used Windows 95 NFS clients with a Linux server about 3 years ago and had some interesting problems occur. I know that it is dated info but it would be nice to know if these concerns have been addressed:


    1. It's difficult to find a good Windows based NFS client. I was using time limited demo clients for an educational setting and they would cause all sorts of problems like locking up of Win95 - yeah I know, its probably Win95. How has it changed for Windows now?


    2. I had a big security concern that anyone who had a laptop with Unix loaded and running nfsclient would be able to log in with root privileges. You needed root access on the client not on the server and then you could su to any user.


    I can see now that with the widespread use of DHCP servers, that restricting access to IP addresses won't work.

    1. Re:NFS does have problems... by autechre · · Score: 3, Informative

      For the Windows clients, I just use Samba . It gets the job done quite well, though to use encrypted passwords you do have to maintain a separate password file for it. It does have a facility to sync the *nix passwd file to its own, though.

      For the other problem, you should look into the root_squash option.

      --
      WMBC freeform/independent online radio.
    2. Re:NFS does have problems... by bogado · · Score: 2

      The root squash option is not enougth because you can aways su to the desired user after going into root.

      --
      []'s Victor Bogado da Silva Lins

      ^[:wq

    3. Re:NFS does have problems... by Anonymous Coward · · Score: 0

      to use encrypted passwords you do have to maintain a separate password file for it. It does have a facility to sync the *nix passwd file

      Thats where pam_smbpass comes in, its updates the sampasswd whenever it gets a plaintext password. Either loging in (local/shh/telnet/xdm) or when changing a password. Its even posible to trow out your own /etc/shadow and use smbpasswd as only means of authentication.
      Anyway you are up the the mercy of l0phtcrack instead of a slow md5 cracker (still beats a crc I think)

  11. NFS Howto by I+Want+GNU! · · Score: 4, Informative

    There is already stuff about NFS! The NFS HOWTO can be found at http://nfs.sourceforge.net/nfs-howto/

    1. Re:NFS Howto by edhall · · Score: 2

      That's the Linux NFS HOWTO. Although it gives some good background on NFS (and in more depth than the article discussed here) it's pretty Linux-specific when it comes down to the actual setup process. It's not going to give you any FreeBSD-specific information, and so is of limited usefulness in setting up for that system.

      I'm amazed that a comment that's arguably off-topic gets modded up twice as "Informative," but this is, after all, Slashdot.

      -Ed
  12. [^/.] by nslu · · Score: 0, Flamebait

    What's that? slashdot for dummies? What will it me next? -- link to step-by-step manual of XFree86 configuration for matrox G200 PCI card? Nah, XF86Config is too complex, probably walkthrough on changing display resolution in winXP will be next. go-jenny-go!

  13. Tip for better NFS performance in FreeBSD by vrgngoddess · · Score: 3, Informative

    Just a tip... by default, FreeBSD uses conservative NFS mounting options. Note that these work well when trying to interoperate with other Unixes; everybody speaks the lowest common denominator. You can use mount options to augment NFS performance but reduce interoperability somewhat. These options aren't necessary when you're working with one or two clients, but as your NFS installation grows, you'll find them helpful. They may or may not work with other operating systems; it depends on what those OSs support.

    1. Re:Tip for better NFS performance in FreeBSD by wadetemp · · Score: 2

      That was pointed out in the article... interestingly, using 99% of the same words and sentance structures your post uses.

      Coincidence? I think not. :)

  14. Re:BSD SUCKS! by stinky+wizzleteats · · Score: 1

    At the risk of feeding the trolls...

    can someone point out any good points about bsd?

    My firm uses openBSD extensively as a firewall. Where Linux is flexible and versatile, *BSD is more logically put together and better documented. The clear advantage to *BSD, however, is security. Nothing can touch it.

  15. Re:*BSD is dying by Anonymous Coward · · Score: 0

    They should have started at the beginning so we could better appreciate the narrative thread Even the ones that are done are not in chronological order - Pauling probably arranged them loosely by subject. E.g. 35b has entries from 1938-1939, 1946, 1955, 1968 and 1986-1988 and seems to be about a textbook, aluminium and cancer 44 is 1991-1994 and has lots of heavy metal stuff. 46 is 1967-1972 and contains stuff about transition metals and loads of misc stuff. It's going to take a while to read his handwriting :-)

  16. NFS is REALLY insecure. But there are secure Alt. by oobeleck · · Score: 3, Informative

    NFS has a long history of insecurities.(Link takes a little while to load...)
    Also in the article he claims: "You can reboot a server and the client won't crash." Maybe not crash but at least with Solaris (in my experience) you hang the entire system during the reboot. Sometimes it comes back and sometimes it doesn't.
    For a secure alternative that runs on *BSD/Solaris/Linux w/(2.4 Kernels) try out:
    Self-Certifying Filesystem.
    The authors do warn that it is in alpha stage but also claim they have never lost a file. VERY cool project.

    And of course as the OpenBSD Journal has noted, SysAdmin Mag is running an article on Tunneling NFS over SSH.

  17. You CAN have multiple lines for the same partition by fist · · Score: 5, Informative

    Comments about /etc/exports...
    "There are no identifiers between the components of the line. Yes, it would be easier to read if we could put each shared directory on its own line, but we can't; they're all on the same partition. The FreeBSD team could rewrite this so that it had more structure, but then our /etc/exports would be incompatible with that from any other Unix."

    What?!?! Did this guy even read the man page for /etc/exports? Of course you can have seperate directories from the same partition on different lines!! In the man page they have an example of it! Plus there is this comment lifted directly from the FreeBSD 4.5 man page for /etc/exports.

    "Mount points for a filesystem may appear on multiple lines each with different sets of hosts and export options."

    Michael's articles are usually of excellent quality, but I can't believe how many other mistakes he's made! The article is written to familiarize a "junior" sys admin to NFS, but only teaches them bad habits. Hopefully he'll do a little more research for his future articles.

  18. NFS clients for windows? by otomo_1001 · · Score: 1

    I've spent quite some time trying to find a nfs client for windows. Does such a beast exist?

    I've found more than enough shareware/etc... but have been unable to find a open source solution.

    Does anyone know of a free nfs client for windows?

    1. Re:NFS clients for windows? by m0rten · · Score: 1

      I belive there is an NFS client called "Omni NFS", try looking at their webpage

    2. Re:NFS clients for windows? by Eric+Destiny · · Score: 1

      Well, the /. crowd should love this one. Microsoft makes a package called Windows Services for UNIX. This package includes an NFS server and client and allows you to work with NFS exports as if you were sharing them with other Windows clients. It works pretty well (although it doesn't seem to like OpenBSD at the moment) and also includes ActivePerl and a UNIX-like shell for Windows.

      --

      "The meek shall inherit the earth, the rest of us shall go to the stars." Isaac Asimov

    3. Re:NFS clients for windows? by Anonymous Coward · · Score: 0

      Its not free.

    4. Re:NFS clients for windows? by dmelomed · · Score: 1

      And they bought it from someone (Interix?).

  19. SFS (was Re:Corrections, pointers, and cautions) by angio · · Score: 3, Informative
    Yup. SFS is still "developmentware," but it's the most stable developmentware you'll ever use; DM writes really solid code. I've been using it for more than a year to edit source code, listen to music, and generally access my school home directory from home (and from my laptop when I travel).

    I haven't had any SFS problems for over 6 months, since 0.5i. But the notice is correct - your mileage may vary, and use with caution. I've seen SFS tickle bugs in the Linux NFS implementation, but the latest Linux NFS support is much improved over 2.2. On Open/FreeBSD, it's quite solid, IMHO.

    For further info, browse the SFS-users mailing list. It's a good way to get a feel for the issues involved in running SFS.

    (Obligatory disclosure: I'm not one of the developers, but my office is across the hall).

  20. Umm.. yep, not to be mean but. by Deal-a-Neil · · Score: 1

    ..this intro to NFS is kinda light for /. Understanding NFS -- I believed I was going to be reading about the gushy internal stuff that goes on but in layman terms, but rather, I found stuff that any *nix admin here on /. has known for years. Don't slip. First, that horrible reference to that horrible Google ad-words article, then this.

    1. Re:Umm.. yep, not to be mean but. by unclefucknut · · Score: 1

      There are a lot of sysadmins here, but I have a hunch that there are more newbies and sysadmin wannabees here. Also, there are many Linux -> FreeBSD converts that could use this information. (I don't know how similar NFS on those platforms are, but I'm sure there are some differences).

  21. NFS Rocks by captaineo · · Score: 1

    NFS rocks. Coming from the PC world, I was shocked when I discovered how long this useful standard has been around, and how compatible the implementations are... A little while ago I added an old SGI Indy to my Linux network. I tried mounting my primary NFS share on it, expecting to spend several hours troubleshooting in IRIX before it would work. And whaddya know, it came up perfectly the first time =).

    1. Re:NFS Rocks by unclefucknut · · Score: 1

      A hole in one every time. You can't beat such a record with SMB (Windows shares) w/o having an MSCE (connecting win98 machines with windows 2000 is not always a "turn key" thing.. *grumble* what's up with those Redmond freaks?)

    2. Re:NFS Rocks by jo42 · · Score: 1
      > what's up with those Redmond freaks

      Bad weed. It rains too much in the NW, the local weed crop blows big time.

  22. Security by NWT · · Score: 3, Informative

    For those who are interested in a more secure NFS, i found an interesting article about encypted NFS (via openssh) It's a good read, and really interesting! Unfortunately it's written for Linux, but it's easy to adapt it to *BSD. Check it out here!

    --
    Life sucks.
  23. Interesting read... by worth · · Score: 1

    The article makes quite an interesting read. I enjoyed reading it, and if you want even more information, read this.

  24. don't give pointers by Anonymous Coward · · Score: 0

    As we all know pointers make code insecure.

  25. Re:Interview with Pete Seeger by Anonymous Coward · · Score: 0

    and *your* mother. and your mother's mother.

    but, you knew that.

  26. Re:Interview with Pete Seeger by Anonymous Coward · · Score: 0

    ha ha ha, and ha.

    you congenital moron... surprised you could dig out from under your rock long enough to post your semi-literate garbage.

    eat McShit and die. thanks.

  27. Re:Fuck it by Anonymous Coward · · Score: 0

    You guys are in exactly the same position I was in (and partially still am) a year ago.

    I went to a large midwestern engineering school in the middle of a cornfield for a CS degree (if I mention the name, there are people possibly reading who will know who I am and I'd like to avoid that; suffice it to say that it's on roughly the same level of quality and reputation as U of I-Champaign). I did practically nothing but download warez and porn and DivX's and post to various message boards. I spent nearly every weekend night in my dorm, doing all this.

    Meanwhile, my roommate and his gf were out with a bunch of friends having fun, or watching a DivX in our room, or having sex behind my back in his bed...

    Meanwhile, I had no inclination (as a freshman no less) to do any homework whatsoever.

    To say I was depressed would be an understatement - I was seriously considering suicide (nobody else knew I was considering it though - I knew if I mentioned it to anybody I'd be locked away in the loony bin) by the time I left the school with a near-failing GPA.

    But I decided to see where life would take me. And while it hasn't been easy or fun, and frankly a it's been a total PITA and humiliation trip, it's been good for me.

    I started off going to work for a Linux startup that went bankrupt not long after 9/11, thinking the real world would be better. In some ways, it was (some adults are actually pretty cool), but in other ways, it sucked far far worse than college (waking up at 5a.m. to catch a train, then coming home on the train at 6p.m. sucks ass!). We were eventually all laid off, so I decided to go back to school at a community college.

    So what happens? I took a full semester's worth of work in half the time -- and got straight A's doing it! Granted, 1/4 of the credit I was taking was total bullshit (like "intro to the Internet" - oh no!), but the other 3/4 of the credit was roughly 50-90% as difficult as in a real university. I was shocked to find out how well I'd done.

    This semester, at the same CC is much the same, although I suck at math *badly*, and so I'm likely going to drop and retake Calculus2, seeing as there's no penalty for dropping classes like there were at the big Uni. Otherwise, my grades are quite good once again.

    Do I have a girlfriend? Well, the fact that I'm posting on /. at 4a.m. on a Sat. night should answer that question... no, I don't, and never have had one. :( Although I've been "friends with benefits" with a few girls here and there, but that's not the same thing. I'd like to find love, but I have higher priorities at the moment.

    What's my current attitude for success? Forget finding women at a community college, because they really are as stupid as the imbeciles you remember from high school, and concentrate on working hard and focusing on the homework at hand.

    After all -- if you can't make it at a CC, quite honestly, you're not gonna make it anywhere else. Fortunately, CC's are nearly as easy as high school. :)

    Summary: Forget the women until your grades come up. You won't be able to take care of the women or make them happy (with money typically) until you have the degree that says you deserve big bucks anyway, so that might as well be your primary focus. You gotta think like the A-Team -- there's *always* a solution to every problem, and it feels great when "a plan comes together." :)

    So make a plan -- I planned to go to school, but a decent job offer came up so I took it, but that failed so I went back to school after seeing RL sucks, and was more motivated than ever before in my entire life, mainly because I had nothing left to lose.

    Although, there is a LOT to be said for getting women now, because someday, it really *is* going to be too late.

    Basically, life sucks, it's true, and don't ever forget it. But at the same time, try to channel your depression and anger at the hand life has dealt you into something productive. You wouldn't believe just how effective a strong "fuck the world" attitude - properly channeled of course - can be at being at least academically successful (and it actually helped me meet a nice girl, but unfortunately our interests are total opposites (she hates computers and I *live* for computers), so nothing really is resulting from it).

    The worst part about all of what I've said is this: you won't realize I'm right until you've experienced all this failure yourself. Trust me on this one, that's exactly what I found out.

    I can't say I'm a success story yet because I'm not done with my BSCS! But most of the signs are pointing *MY* way now for once! And despite doing poorly in Calc2, overall I've rarely felt better in my life.

    I, for one, am glad I stopped short of taking my dad's shotgun to my head... And it didn't require going to a psychologist to avoid either, so I have no record of mental illness (nobody's gonna hire somebody who's been found insane! Partially or otherwise...). It's just a matter of "getting root" on your brain and controlling your psyche, willpower, and determination. And believe it or not, I did it using no other drugs than the very occasional (once every couple of months) use of alcohol; no other drugs necessary. And the best part, is that I did it all on my own, with no more help than monetary support from my parents... And you can too.

    Seriously, don't give up just yet guys.

    *BSD may be dying, but you guys don't have to...

    [Sorry about length, BTW, but this has become a very deep-seated issue with me, as you can tell, and I absolutely HATE to see people fail or get depressed for the same reasons I was.]

  28. Bleak days, bitter nights, for *BSD by Anonymous Coward · · Score: 0
    So whynow? Why dd *BSD fail? Once you get past the fact that *BSD is fragmented between a myriad of incompatible kernels, there is the historical record of failure and of failed operating systems. *BSD experienced moderate success about 15 years ago in academic circles. Since then it has been in steady decline. We all know *BSD keeps losing market share but why? Is it the problematic personalities of many of the key players? Or is it larger than their troubled personalities?

    The record is clear on one thing: no operating system has ever come back from the grave. Efforts to resuscitate *BSD are one step away from spiritualists wishing to communicate with the dead. As the situation grows more desperate for the adherents of this doomed OS, the sorrow takes hold. An unremitting gloom hangs like a death shround over a once hopeful *BSD community. The hope is gone; a mournful nostalgia has settled in. Now is the end time for *BSD.

    1. Re:Bleak days, bitter nights, for *BSD by Melantha_Bacchae · · Score: 2, Interesting

      An AC writes:

      > We all know *BSD keeps losing market share but why?

      Um, because it is gaining market share?

      Apple, in their last quarter report, announced the sale of one million boxes of OS X (a *BSD OS) and two million systems with it on the hard drive.

      The new iMac, booting OS X by default, had 150,000 preorders.

      The new iMac is the top selling computer for all time at Amazon. It is outselling every XP PC on Amazon.

      Out of the top 25 bestselling computers on Amazon, 10 were Macs, and all Macs are now shipping OS X as the default booting OS.

      ZDNet ran this (http://techupdate.zdnet.com/techupdate/stories/ma in/0,14179,2659085,00.html) article about how the number of *BSD users will soon exceed the number of Linux users, largely thanks to OS X and Darwin. *BSD already has three times the number of Linux desktop users. (And if the Linux users aren't happy about this, they can just run out and make more Linux users and make Linux more successful on the desktop. Then we can have a fun race with them. ;)

      > An unremitting gloom hangs like a death shround over a once hopeful
      > *BSD community. The hope is gone; a mournful nostalgia has
      > settled in. Now is the end time for *BSD.

      Sorry to burst your tragic bubble (not really ;) but *BSD is currently in no danger of death.

      *BSD is in serious danger of growth!

      Oh, there is a doomed OS alright. It is an evil empire, built on a foundation that now crumbles and groans under its weight. This empire doesn't see the danger. It never will, until it is too late. A hero thrice thought dead (Apple, Next, *BSD), now reborn, arises to shatter its foundations.

      Beyond time, beyond terror, beyond death, Mothra:
      Your heart can reach...Life!

    2. Re:Bleak days, bitter nights, for *BSD by Anonymous Coward · · Score: 0

      Funny... Last time I checked OS X ran the Mach kernel and not the BSD one :-)

      Sure, they do use a lot of components from BSD, and you could claim that OS X is more or less based on it, but it's not completely accurate to say it IS *BSD.

  29. Encrypt NFS through an SSH tunnel, read this!!! by Anonymous Coward · · Score: 0

    This is from a link I saw on LinuxToday last week
    Run SSH to set up a port forwarding "tunnel" and then run NFS through it so that all traffic will be encrypted. It will slow down performance but it's better than living in fear!

    http://www.samag.com/print/documentID=22157

    P.S. SSH rules!!! :)

  30. Nonetheless NFS is seriously flawed by Anonymous Coward · · Score: 0

    - security. If you run it (and yes it can be convenient to have, say, all your mp3 files accessible from every client on your local net) then do so behind a big fat firewall.

    - stability. Notably you shouldn't use softupdates on an NFS export or sooner or later you're going to see panics.

    - performance. Is awful. Even copying through scp is faster than NFS.

    In short, NFS has its merits but for anything serious or anything in an unprotected network zone I'd definately vote against it.

    Strange BTW that the article doesn't mention the AMD (auto mount daemon). While I personally found it hideous its worth mentioning that one can have their shares auto mounted and unmounted on demand.

    Last point: NFS was thought up by Sun. What were we expecting anyway :-)

  31. Robust????!?!?! by $kr1p7_k177y · · Score: 1

    "You can reboot a server and the client won't crash. It won't be able to access files on the server's export while the server is down, but once it returns, you'll pick up right where things left off. Other network file sharing systems are not so resilient."

    From regular personal experience, I can state that NFS is hardly so robust under HPUX.... Is BSD really this foolproof?

    1. Re:Robust????!?!?! by Arandir · · Score: 2

      I've only had NFS on my FreeBSD box at work for a short while. But I've had it on my Solaris box for three years now. For a while last year the server would crash and burn every hour or two. A very horrible situation that only got resolved when we threatened to send to the servers back to Sun via patriot missile. This went on for a week. Not once did it cause any of the Solaris clients to buckle or fold.

      p.s. I suspect that a certain Sun rep deliberately sabotaged our servers in order to generate support calls. Obviously he is no longer a Sun rep.

      --
      A Government Is a Body of People, Usually Notably Ungoverned
  32. Security issues .. by AftanGustur · · Score: 2


    I had alot of fun with NFS during my Univerity years. Sure it has some nice features as it's lightning-fast and stateless but it's totally unsecure, period.

    The NFS server has two parts, the authentication part and the data-server part. The authentication part authenticates based on the IP address of the requester, if successful, it will send the requester the 'key' for the export.
    After that, anybody can use that key to request files from the data-server part. And from any IP address!!

    There exist a very nice ftp-like tool that lets you play with NFS systems, enter the key manually or use the UID overflow bug to get root privs. And this is only the beginning of the fun !!

    Trust me, "Don't use NFS" unless you are running it on a network that is not connected to the rest of the world, and you trust everyone that has access to this network.

    --
    echo '[q]sa[ln0=aln80~Psnlbx]16isb572CCB9AE9DB03273snlbxq' |dc
    1. Re:Security issues .. by unclefucknut · · Score: 1

      Use IPSEC authentication (AH or ESP if you also need encryption). Doesn't get much more secure than that.. The rest is your fault.. ;)

    2. Re:Security issues .. by AftanGustur · · Score: 2


      Use IPSEC authentication (AH or ESP if you also need encryption).

      Try that for 3000 clients and your performance is toast !

      --
      echo '[q]sa[ln0=aln80~Psnlbx]16isb572CCB9AE9DB03273snlbxq' |dc
    3. Re:Security issues .. by unclefucknut · · Score: 2, Interesting
      Try that for 3000 clients and your performance is toast !

      1. Cluster your export points
      2. Use hardware accelerated encryption devices
      3. Ask yourself: do these 3000 clients really need access? And what part of the local file system do they need access to? I realize that querying 3000 users for their purposes is a bloody hard job now, but it should have been done in the first place. Follow the principle of least privilege.

      For an organization with 3000 external clients, security shoult be at the top of the TODO-list. Finding a hacker/spoofer among 3000 clients is like finding a needle in a haystack. If this scenario is yours, then please reconsider some major security face lifts...

    4. Re:Security issues .. by AftanGustur · · Score: 2

      What you are proposing is throwing huge amounts of money out the window to fix a broken protocol.
      Have you *any* idea what 3000 encryption hardware accelerators might cost ? (+ servers)

      The "Correct" way, from every standpoint is simply not to use NFS, but some other protocol that has the security parts you need. For example, as long as you can protect the authentication credentials, encrypting the contents might not not be as important.

      But, many have also taken the "more money" way, and the simplest path to follow there (from an administrational point of view) is simply to use microsoft.

      The scenario is not mine, but not many years ago, a lot of universities had this setup. There are a LOT of hackers there, and many have switched to microsoft CIFS now.

      --
      echo '[q]sa[ln0=aln80~Psnlbx]16isb572CCB9AE9DB03273snlbxq' |dc
  33. FreeBSD: Tedious installation by Anonymous Coward · · Score: 0

    At one point I was planing on installing FreeBSD along side slackware linux. The installation was much too tedious however.

  34. Re:BSD SUCKS! by Anonymous Coward · · Score: 0

    that's font, cockmaster

  35. Re:Fuck it by yomegaman · · Score: 0, Offtopic

    If you graduated HS in 98 that makes you 22 or so? No way is that too old to go to college. Hell, as the only freshman old enough to buy beer you'd probably be the most popular guy in the dorm.

    --
    ...wearing a skin-tight topless leather jumpsuit, with cutaway buttocks and transparent crotch panel.
  36. Latest SysAdmin Magazine by totallygeek · · Score: 2
    Check out the latest SysAdmin Magazine. It has an article about securing NFS using SSH.

    --
    Click here or here.
  37. Re:NFS is REALLY insecure. But there are secure Al by Anonymous Coward · · Score: 0

    Our experience is that on Solaris, if you have an NFS mount that has a failed (offline) server, you will not get an SSH login prompt. OpenSSH apparently scans the file system before providing the prompt, and since it is waiting for NFS to return the mount's info, it never gives the prompt. Would mounting partitions 'soft' fix this?

  38. Re:NFS is REALLY insecure. But there are secure Al by Anonymous Coward · · Score: 0

    Yes.

  39. No free Windows NFS clients, but any under $99? by Anonymous Coward · · Score: 0

    These Windows NFS clients are typically over $300 per seat - which is simply insane. Is there a high quality NFS client for Windows under $100?

    Samba is good, but it has to run on the (UNIX) machine that can see the native file system. I'd like to bypass Samba and have the Windows clients talk to NFS directly.

  40. This is incorrect information by Just+Some+Guy · · Score: 2
    What?!?! Did this guy even read the man page for /etc/exports? Of course you can have seperate directories from the same partition on different lines!! In the man page they have an example of it!

    The article is correct; only mountpoints (and not subdirectories) can be entries in /etc/exports. From the `exports' man page (emphasis mine):

    Each line in the file (other than comment lines that begin with a #) specifies the mount point(s) and export flags within one local server filesystem for one or more hosts.


    Furthermore, the only example given in the man page explicitly identifies the directories listed as mountpoints.

    Please don't moderate up comments that sound informational without actually checking your facts first.

    --
    Dewey, what part of this looks like authorities should be involved?
    1. Re:This is incorrect information by fist · · Score: 1

      The article is NOT correct.

      By "mount point(s)" the man page refers to what the client filesystem will use as mount points. Since you've obviously have no experience with NFS I'll give you a quick example of exporting a subdirectory inside a local mount point on its own line. (Notice how /tmp/test is subdirectory in the root filesystem, yet it works as an entry in the exports file!)

      #uname -r
      4.5-STABLE
      # cd /tmp/
      # mkdir test
      # cd test
      # touch hello
      # echo "/tmp/test -maproot=0" > /etc/exports
      # killall -HUP mountd
      # mount localhost:/tmp/test /cdrom
      # cd /cdrom ; ls
      hello
      #

      I believe that the last statement in your post should probably apply to you.

    2. Re:This is incorrect information by rthille · · Score: 1

      I believe the problem is that you may not export two different directories from a single filesystem, you need to instead export their (single) parent.

      --
      Awesome furniture, accessories and cabinetry in Santa Rosa, CA: http://humanity-home.com/
  41. Use of NFS Considered Harmful by shani · · Score: 1

    Personally I recommend never using NFS. Heck, I wrote a paper about it. It's a bit old, and doesn't cover NFSv4. But of course, NFSv4 doesn't address the basic issue of using the wrong model for the problem, so that's not a big deal. :)

    1. Re:Use of NFS Considered Harmful by mre5565 · · Score: 1

      > Heck, I wrote a paper [time-travellers.org] about it. It's a bit old, and doesn't cover NFSv4.

      Old? It's ancient. Virtually every point
      you have in your little paper is nonsense,
      at least when it comes to commericial grade
      NFS implementations.

    2. Re:Use of NFS Considered Harmful by shani · · Score: 1

      Virtually every point you have in your little paper is nonsense, at least when it comes to commericial grade NFS implementations.

      I'd be very interested to know which points are nonsense, and also what you consider a "commercial grade" NFS implementation. Remember that a lot of these issues are client-side related, and I'm especially not sure what a "commercial grade" NFS client is.

      My experience with NFS is limited to Network Appliance, Solaris, Linux, BSDi, SCO, and Digital Unix (as well as some early Windows NFS applications).

  42. As the author... by agshekeloh · · Score: 1

    re uid/username: mea culpa.

    My original title on this piece was "Introduction to NFS". To the best of my knowledge, ten people in the world truly, deeply understand NFS. Six have won Nobel Prizes, three are in the Institute for the Criminally Insane, and one is not allowed sharp objects and drools on himself a lot. O'Reilly does not seem to like my original titles... ah, well.

    Finally, if Slashdot was going to pick up one of my articles... why, my God, did they choose this one? There are many far more interesting and informative Big Scary Daemons out there... take a look at "Linux Emulation, the Hard Way" for one I'm especially proud of. Sigh. Obviously, they don't want the editorial standard to go above that maintained by other Slashdot authors...

  43. are lockd's compatible across different OS'es? by Anonymous Coward · · Score: 0

    There has always been a problem that NFS was compatable across OS'es, but only SunOS/Solaris respected file locks held across the network (via lockd) - is this still the case?

  44. Re:You CAN have multiple lines for the same partit by Dahan · · Score: 2

    Well, just because you can do something, it doesn't mean you should. NFS doesn't export directories--NFS exports filesystems. If you have a FS mounted on /share, and you export /share/somedir, you've actually exported all of /share, even though you may not realize it.